Operation Aurora, the massive cyberassault on Google, Adobe, Juniper, Rackspace and others, proved that intellectual property is as much a target as credit-card data and other customer info, so perhaps it's no coincidence that more than 90% of the 1,002 business technology and security professionals who responded to our survey expressed concern that such an exploit could affect their organizations. Nearly one-third are "very concerned" that it could happen to them.

As we watched the news and read the coverage in both technical and mainstream media outlets, we saw people finally waking up. CISOs everywhere got copies of the venerable, "Could this happen to us?" email from management and had to answer questions about how they could hope to fend off these attacks if Google, which employs hundreds of security pros, had to withdraw from the largest emerging market and leave millions on the table.

Security researchers group these attacks under the category of advanced persistent threat, or APT. We see APT as shorthand for a targeted assault, where the attacker’s skill level and resources are advanced. When they get in, often via social engineering, they seek to stay undetected and tunnel deeper into the network, then quietly export valuable data. Cleaning up the mess is an expensive nightmare. As we said, government entities have been using this terminology for some time, but this was the first major announcement of a successful zero-day attack being conducted against a private company. The fact is, after several years of both our budgets and our data being under siege, few organizations have the means to fight off world-class attackers. But putting your head in the sand is a bad plan, as is throwing up your hands and blaming upper management. As we’ve said before, in every security survey we deploy, a healthy percentage of commenters say they long for a major breach to wake business leaders up.

With worries about advanced persistent threat (APT) intensifying, companies are devoting more time and staff resources to related protective measures. For instance, 30% of our 1,002 survey respondents said they now spend a great deal of time and staff resources on virus and worm detection and research-that's a 25% increase over 2009. Likewise, the percentage of organizations dedicating a great deal of time and staff resources to incident response and end-user security awareness training has risen 14% and 22%, respectively.

Apparently, not everyone feels increasingly insecure. Only 16% of the 1,002 professionals we polled said their organizations are more vulnerable to malicious attacks and security breaches than they were a year ago, despite the seeming ability of attackers to infiltrate even the most well-defended networks. That's just slightly more than the previous year. Other respondents may be overly confident. Will their complacency leave them prime for problems?

More realistic expectations? More than one-third of our poll respondents -- 36% vs. last year's 32% -- told us they anticipate that their organizations will be the target of some form of security breach or espionage within the next year.

Fewer than one-quarter of all 1,002 business tech and security pros we polled said their organizations experienced a security breach or espionage in the past year, representing just a slight uptick over last year. The vast majority of companies, it seems, managed to stay safe despite the mounting challenges.
Learn more about InformationWeek Analytics'Global Threat, Local Pain: 2010 Strategic Security Survey.

Our survey respondents ranked hackers, at 77%, the biggest source of breaches or espionage posing a threat to their organizations, followed by authorized users/employees (70%), application vulnerabilities (63%), external users (44%) and contracted service providers/consultants/auditors (36%). Said one poll respondent, "Outsourcing has been our biggest source of breaches and data loss."

Welcome to
TechWeb, the IT professional's online resource for news coverage of the
information technology industry. We know technology news. Our mobile
and wireless news coverage moves as fast as wireless technology itself.
We follow all the devices you depend on to stay connected. Our software
coverage follows the multi-faceted software industry from every angle.
We've got a lock on network security and computer security issues.
We're all over the business of the Web--the Internet business--and the
engines that run it. We have our eyes and ears tuned to the players who
make and run the tools that tie us all together--Google, Microsoft,
eBay, Cisco, Yahoo, Oracle, Apple, Sony--and scores of others. And we
keep close tabs on the backbone of information technology, PC hardware.
We know PCs and Apple computers inside and out. We cover computer
technology, computer news, software news, search engine news, business
software, operating systems, and software development. Our coverage of
tech news includes a strong focus on the security business, its
attendant spyware and viruses, how security relates to wireless
technology and business networking and the security issues surrounding
RFID technology. We closely follow developments in Internet news and
Internet technology, including the spread of broadband and its effect
on Web browsers and the Web business. We watch the VoIP business, and
how VoIP technology is affecting the state of telephony in the
enterprise. And if all that isn't enough, we also track developments in
the IT industry that affect IT jobs, IT careers, and outsourcing.